Part of the problem is that the regulations aren't just seeking to cover companies that hold peoples' funds (aka private keys), but instead any technology touching the ecosystem. New York doesn't have to and shouldn't conflate the two.

It makes sense to regulate and, for example, require escrow for companies that are holding user funds in order to avoid the exact situation you point out. It doesn't make sense for a web wallet where the user is storing her own keys client-side.